Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

There is no doubt in my mind that spaces should be allowed in passwords. I see some websites disallow spaces, symbols in passwords and even enforce minimum length which seems t otally nonsensical to me.

Normally I'd check that user passwords contain:

  1. minimum of 6 characters
  2. Upper case letters
  3. Lower case letters
  4. Numbers
  5. Symbols

Here's my question:

Which of these categories should space fall under? Can I count it as a symbol? Or is it in it's own category adding nothing but length to the perceived complexity of the password?

Counting a space as a symbol would allow the following password:

"Ab1 "

Which frankly does not look safe so should I allow the spaces to count as symbols? (and do they add enough complexity to the password to be counted as symbols?)

This is the JavaScript function that I'd usually use to check passwords but given the above password this function will return false, deeming it insufficiently complex.

function checkPassword(password) {
    if (password.match(/[A-Z]/) 
      && password.match(/[a-z]/) 
      && password.match(/[0-9]/) 
      && password.match(/[£:#@~\.,|(etc....)]/) 
      && password.length >= 6) {
        return true;
    } else {
        return false;
    }  
} 
share|improve this question

1 Answer 1

up vote 6 down vote accepted

From a complexity perspective it doesn't matter whether you classify a space as a symbol or in a class of its own, the more characters that can be used in a password the harder it will be to crack, provided people use the complexity to its full potential.

From a practical perspective given the code above your best bet is to add it to the symbol list, as if you added it as a separate line you would make it a requirement to put in a space, which would defeat the purpose as that would be a gift for anyone looking to crack your passwords - they already know one of the characters.

I must point out that the argument you use saying that "Ab1 " isn't a good password would go for any of the other symbols you allow as you code would treat "Ab1@@@" the same way. "AAAb1 " and "Abbb1 " would be equally permissible, and no stronger either.

My main recommendation for you would be to require longer passwords as 6 characters is pretty weak, no matter what complexity requirements you have. 8, or preferably 9 characters would be orders of magnitude stronger.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.